Guardium Data Protection CVE-2026-84276

Exploitation requires network access to the Guardium Data Protection edge-controller gRPC service (the specific exposed component), against which an unauthenticated attacker sends malformed task data to trigger the unchecked type assertion. The CVSS vector (PR:N/UI:N/AC:L) confirms no authentication, no user interaction, and no special timing are needed once the gRPC endpoint is reachable. The primary limiting factor is reachability: the edge-controller gRPC port must be accessible to the attacker, so deployments that restrict this service to isolated internal management networks are not exposed to arbitrary remote attackers. Impact is limited to availability (process termination); no data disclosure or modification occurs.

This is a genuine but bounded-impact availability issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) is internally consistent with the description: a remote, unauthenticated, low-complexity attack with no user interaction, impacting only availability (C:N/I:N) via CWE-400 resource exhaustion/crash. There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is not currently a confirmed-exploited emergency. The 7.5 rating is driven entirely by the A:H availability impact; because there is zero confidentiality or integrity impact, this is a lower real-world priority than a 7.5 with data exposure would be. The practical risk hinges on network exposure of the edge-controller gRPC service: if that port is reachable only from trusted internal management networks (typical for Guardium deployments), real-world risk is substantially lower than the 'network' vector implies. A vendor patch is available, which is the clear remediation signal. No signals conflict; the main uncertainty is the actual network reachability of the gRPC service in production, which defenders must verify locally.

An attacker with network reachability to the IBM Guardium edge-controller gRPC service sends a crafted task message containing malformed data that violates an expected type. The unchecked type assertion in the edge-controller fails, causing the process to crash and halting data-protection monitoring until the service restarts. No public proof-of-concept is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or conditions are needed once the service is reachable.